IN THE UNITED STATES DISTRICT COURT 
FOR THE NORTHERN DISTRICT OF GEORGIA 
ATLANTA DIVISION 


DONNA CURLING, et al. 
Plaintiffs, 


v. 


BRAD RAFFENSPERGER, et al. 
Defendants. 


CIVIL ACTION 

FILE NO. l:17-cv-2989-AT 


STATE DEFENDANTS’ RESPONSE TO PLAINTIFFS’ 
PROPOSAL FOR REVIEW OF GEMS DATABASE 

In working to balance the needs of Plaintiffs to review the GEMS Database 
with the documented security interests 1 of State Defendants, this Court proposed a 
review of the GEMS Database by Plaintiffs’ attorneys and experts in a facility 
operated by the Secretary of State. [Doc. 446, p. 2]. While the Curling Plaintiffs 
originally found that proposal workable, all Plaintiffs now argue that such a 
proposal is not a reasonable option. [Doc. 451]. 


1 Plaintiffs’ latest filing continues to argue that the GEMS Database should be 
released without restriction and that the State takes no efforts to protect the 
databases it distributes to counties. The State has already addressed these issues 
and will not take the Court’s time responding to arguments that do not reflect the 
facts in the record. Also, the current dispute is only about the GEMS Database 
(6/28/19 Transcript at 12:18-13:4), despite Plaintiffs’ references to the server itself 
in their pleading. 



State Defendants remain unclear about the individuals Plaintiffs seek to have 


review the database, especially as Plaintiffs continue to expand the universe of 
people they identify as “experts.” On the call, Plaintiffs indicated that the review 
would be conducted by Dr. Halderman and Mr. Bernhard. (6/28/19 Transcript at 
41:10-15.) Curling Plaintiffs have identified Dr. Halderman as their expert. [Doc. 
428, p. 2]. But two days ago, Coalition Plaintiffs identified four individuals as 
experts—Mr. Bernhard (who is a graduate student and employed by Verified 
Voting), Candice Hoke (a retired professor from Cleveland-Marshall School of 
Law), Virginia Martin (the Democratic Party member on the Columbia County, 
New York Board of Elections), and Amber McReynolds (former director of 
elections for Denver, Colorado who now works for a nonprofit advocating mail 
voting) [Doc. 448, pp. 7-8]. Each of these individuals are activists that support the 
positions Plaintiffs advocate in this lawsuit. Plaintiffs also propose a much wider 
group of assistants to participate in the review process, [Doc. 451, p. 7], and the 
review by Mr. Digges, whose apparent experience involves accounting and 
spreadsheets, not election-management databases. [Doc. 452, p. 8] (identifying Mr. 
Digges as a “Financial professional with knowledge of a broad range of corporate 
financial operations and processes”). Individuals without specialized knowledge 
about computer science have no need for access, particularly when they take 
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advocacy positions. 2 This Court should limit the access to Plaintiffs’ computer- 
science experts, not everyone Plaintiffs ultimately claim is an expert. 

Turning to the scope of the review, this Court required Plaintiffs to identify 
the conditions in the State Defendants’ proposed review protocol that would 
“severely impair their ability to perform the necessary examination.” [Doc. 446, p. 
3]. Plaintiffs did not identify any conditions when they made a proposal to State 
Defendants on July 3 (Email from David Cross, attached as Ex. A), but identified 
two conditions in their brief: 

1. Traveling to Atlanta for an extended review 3 is too burdensome. 

2. The computer on which they conducted the review would need a 
different operating system than the one currently used. 

Plaintiffs then propose an alternative structure that (1) takes place in 
multiple locations not under the control of the Secretary of State, (2) allows the 


2 State Defendants’ concerns on this point were heightened this week when, on the 
evening of July 2, an Associated Press reporter contacted State Defendants’ 
counsel asking for comment on an issue in this case and outlining what the reporter 
said Plaintiffs planned to argue in a motion that has not been filed. Given the 
nature of the critical infrastructure at issue here, access should be restricted only to 
actual computer-science experts. 

3 Plaintiffs now say their review of the databases could potentially take weeks even 
using a team of people. [Doc. 451, p. 3]. On the call, Plaintiffs indicated it would 
only be two individuals. (Transcript, at 41:10-15.) 
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extraction of information from those databases for review by individuals other than 


Plaintiffs’ experts and their attorneys, (3) allows the installation of a variety of yet- 
to-be-determined software (Mr. Bernhard identifies three pieces of software that 
would be required while Dr. Halderman is not sure what he would need), and (4) 
involves an entire team of people conducting the review. 4 Coalition Plaintiffs also 
propose a procedure by which the entire database could ultimately be disclosed to 
the Plaintiffs in this case (and possibly others) and not just their experts and 
attorneys. [Doc. 451-3, p. 3]. 

State Defendants are willing to modify their proposal to address some of the 
specific issues related to a review, but cannot agree to a review that takes place 
outside the control of the Secretary of State’s facilities. As previously detailed to 
the Court, the State takes a number of steps to protect the GEMS Databases and 
has a regulatory structure of State Election Board rules that govern the county 


4 Plaintiffs’ proposals also appear to be inconsistent. In their brief, they propose 
allowing the transfer of files using USB drives plugged directly into the protected 
computers. [Doc. 451 p. 5], but in at least one of the attached Declarations, they 
propose just the opposite—that USB drives cannot be plugged into the protected 
computers [Doc. 451-1, *][ 11]. It is also inconsistent with Dr. Halderman’s position 
on the June 28, 2019 teleconference with the Court, in which he stated that 
reviewing a mirror of the GEMS database on a workstation in the Secretary’s 
facilities was a reasonable proposal. (6/28/19 Transcript at 40:15-24, 42:8-11.) 
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computers that contain the databases (but which do not contain Microsoft Access). 5 


Plaintiffs’ claims in this case are rooted in the claim that the State has not done and 
is not doing enough to protect the election system. But their proposals would 
provide less protection for the data from that system than the State currently uses. 

Beyond the issue of where the review takes place, Plaintiffs have alleged 
that they would need additional software installed, including different operating 
systems and additional programming software. State Defendants are willing to 
create an environment different from the current GEMS system to facilitate 
Plaintiffs’ review. Further, State Defendants do not object to the installation of 
Microsoft Excel, as Mr. Bernhard proposed, but cannot agree to the installation of 
a set of programming software or an unlimited universe of potential software. 

After reviewing Plaintiffs’ proposal, State Defendants are willing to agree to 
the following review conditions: 


5 Plaintiffs, in a footnote, contend that the state shares the GEMS files “without 
meaningful restrictions” to local elections officials in support of their argument 
that GEMS files should not be subject to protections. See [Doc. 451 at 2, n. 2]. This 
assertion, however, ignores the statutory and regulatory scheme that local elections 
officials are bound to follow when executing their official duties. See, e.g., 
O.C.G.A. §§ 21-2-379.24(g) (public disclosure of sensitive election materials 
prohibited absent court order), 21-2-500 (GEMS CD-ROM kept under seal until 
destroyed after 24 months); Ga. Comp. R. & Reg. rr. 183-l-12(2)(e), 183-1-12(6) 
(GEMS CD sealed and servers kept in secure storage). 
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1. Create a server images on computers which will remain in a secure, air- 
gapped environment. 

2. Load a copy of the GEMS Databases 6 from the November 2018 election. 

3. Install Microsoft Access and Microsoft Excel. 

4. Remove the GEMS Application. 

5. Allow Plaintiffs’ experts and attorneys to have supervised access in the 
Secretary of State’s facility. 

6. Plaintiffs will only be permitted to introduce any software or files onto 
the computer that have been reviewed and approved the Secretary of 
State’s IT Department. If there is a dispute about whether a particular 
software is needed to facilitate a review, Plaintiffs may present that 
dispute to the Court. 

7. Plaintiffs will not be permitted to connect any hardware to the computer. 


6 The GEMS Databases prepared by the Secretary of State and sent to the counties 
before the November 2018 election reside on a secure storage server and can be 
easily copied for review. Counties are supposed to provide the final GBF files on a 
CD with their certification packets after the election. Because certification is 
completed based on the paper reports, the Secretary of State does not review each 
individual CD to determine whether the proper files are included. The Secretary of 
State’s office holds all of the CDs in a secure location and will have to upload one 
CD at a time to review the returned databases. It is possible that the counties did 
not include the correct files on the CD they returned. This is easily addressed by 
obtaining the correct files from a county, but will involve an additional step. 
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8. Plaintiffs will not be permitted to remove any files from the computer. 
The Secretary of State’s office will extract any data files Plaintiffs 
believe are required as long as those files contain only data and no 
confidential information and will provide those to Plaintiffs. 

9. Plaintiffs will not be permitted to take pictures or videos of their review 
process. 

10. Plaintiffs must make copies of all notes taken during the review and leave 
a copy of those notes with the Secretary of State’s office except for 
attorney work product. 

This 5th day of July, 2019. 


Vincent R. Russo 

GA Bar No. 242628 

Josh Belinfante 

GA Bar No. 047399 

Carey A. Miller 

GA Bar No. 976240 

Kimberly Anderson 

GA Bar No. 602807 

Alexander Denton 

GA Bar No. 660632 

Brian E. Lake 

GA Bar No. 575966 

ROBBINS ROSS ALLOY 

BELINLANTE LITTLELIELD LLC 

500 14th Street NW 
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Atlanta, GA 30318 
Telephone: (678) 701-9381 
Facsimile: (404) 856-3250 
vrusso @robbinsfirm.com 
jbelinfante@robbinsfirm.com 
cmiller @ robbinsfirm. com 
kanderson@robbinsfirm.com 
adenton@robbinsfirm.com 
blake @ robbinsfirm. com 

/s/Bryan P. Tyson 

Bryan P. Tyson 

GABarNo. 515411 

Bryan F. Jacoutot 

Georgia Bar No. 668272 

TAYLOR ENGLISH DUMA LLP 

1600 Parkwood Circle, Suite 200 

Atlanta, GA 30339 

Telephone: (678)336-7249 

bty son @ taylorenglish. com 

bjacoutot@taylorenglish.com 

Counsel for State Defendants 
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CERTIFICATE OF COMPLIANCE 


Pursuant to L.R. 7.1(D), the undersigned hereby certifies that the foregoing 

STATE DEFENDANTS’ RESPONSE TO PLAINTIFFS’ PROPOSAL FOR 

REVIEW OF GEMS DATABASE has been prepared in Times New Roman 14- 

point, a font and type selection approved by the Court in L.R. 5.1(B). 

/s/Bryan P. Tyson 
Bryan P. Tyson 
GABarNo. 515411 
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CERTIFICATE OF SERVICE 


I hereby certify that on this day, I electronically filed the foregoing STATE 
DEFENDANTS’ RESPONSE TO PLAINTIFFS’ PROPOSAL FOR REVIEW OF 
GEMS DATABASE with the Clerk of Court using the CM/ECF system, which 
will automatically send counsel of record e-mail notification of such filing. 

This 5th day of July, 2019. 


/s/Bryan P. Tyson 
Bryan P. Tyson 


GABarNo. 515411 
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